2015 has been a rough year for the healthcare industry and it’s been constantly in the spotlight for the newly infested cyber crimes in this domain. Since the start of the year, three major health insurers – Anthem, Premera, Carefirst – all Blue Cross Blue Shield plans, have been victims of major data breaches, with up to about 92 million records affected.
For many years, the top cause for patient data theft was a healthcare organization employee losing a device or having one stolen. In 2014, for the first time, the top cause was a criminal attack, according to the recently released fifth annual Ponemon Institute Study on privacy and security of health care data.
Fraudsters have many ways to profit from this data including getting health care themselves or selling it in the blackmarket. Healthcare industries can play a major role in combating cybercrimes with effective security measures. In this post, I’ve have enlisted 7 most practical steps that can be implemented by these organizations.
Make use of big data and analytics for making informed and strategic security decisions.
The first step towards securing healthcare information is to discard obsolete technology of managing patient data and replacing it with latest technologies, which have higher resistance to fight cyber crimes.
Security Information Event Management (SIEM) has been the traditional solution used in data centers. However, SIEMs cannot handle large volumes of data which makes it inefficient after a certain point. There is a tremendous need to employ intelligent analytics to automate mountains of data in a secure manner. Cybercriminals are continually devising better intelligence on security solutions, so they can assume less-visible behavioral patterns to better conceal their actions. Therefore, data must be analyzed quickly to identify actionable insights and keep attackers at bay.
Big data and analytics convert unstructured log and SIEM data to a format that enables informed, strategic decision making, and does away with the ‘false-positives’ that afflict SIEMs. This allows security teams to quickly respond to threats before data leaves the network.
Implement strict measures to tackle BYOD programs
Bring-your-own-device (BYOD) programs are a huge concern for many healthcare organizations that permit their employees to bring their personal laptops, tablets and smartphones. While working, employees install mobile applications and use on their personal devices exposing corporate data to additional risks.
We know as a fact that 98% of the Android applications have security vulnerabilities.
These unsafe practices are widespread in the healthcare industry and IT departments rarely have the bandwidth of time and resources to do anything about it. Many healthcare organizations lack even the most basic mobile device management (MDM) & BYOD tools, policies, and processes.
BYOD and mobile threats change almost constantly due to the proliferation of new mobile applications being written. Healthcare organizations need to implement adaptive technologies to manage identities and to better control the data being accessed. Appknox is a third party tool that helps enterprises to tackle such security issues. It detects loophole and vulnerabilities in the mobile apps and report the problems. It also gives a compliant solution for you to fix these issues.
Understand HIPAA requirements, and formulate a compliance plan
As I highlighted in my previous post, HIPAA compliance alone is not sufficient to build a rock solid security system. Though HIPAA is a standard compliance for healthcare industries, its law in itself is not foolproof in keeping the data safe. A good example of this is encryption. Though the law does mention about the Encryption but also leaves an element of uncertainty.
According to the law – Encryption (Addressable) – Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate.
Hence, companies should review the HIPAA requirements properly and work on the compliance plan so that every single parameter gets covered to ensure full security.
Training your employees about the security risks involved in accessing links and attachments in email
Employees invariably click on emails and other attachments even when they are told the risks involved. This gives an open door to hackers to attack our network and while 75 percent of attacks take only minutes to begin data exfiltration, they take much longer to detect.
Securing email and web gateways will help reduce the instances of network breaches. This includes rewriting or sandboxing suspicious URLs to detect drive-by attacks and by deploying authentication, endpoint, network, and gateway controls that share information for an orchestrated reduction on the attack surface. Other measures include implementing a solid supply chain and vendor management system, promoting education training awareness (ETA), reducing access control lists (ACLs), and knowing what key intellectual property exists on the network and where it’s located.
Monitor your internal systems and logs for evidence of issues
An automated bot or a process that can periodically run through the system to detect loopholes would be a great way to handle a threat. It will help you spot the vulnerability portion of the system in time and rectify it before much damage is done.
If all of this becomes overwhelming for you, there are third party security tools available to help you detect security loopholes in your system and offer compliance checks. At Appknox, we help healthcare businesses detect vulnerabilities and loopholes in the mobile applications.
Healthcare industry needs to take strict measures immediately to protect patient data and buckle up to ensure full network security.
What do you think about the security of the healthcare industry? Do you find the enlisted security measures helpful? Do share your thoughts in the comments below.